T09 · Insecure Skill Coding Practices
Error
- Location
scripts/configure_official_cli.sh:62- Finding
Shell Injection Through Unsafely Generated Wrapper Script
- Content
View full analysis
"$WRAPPER_PATH" < "$CONFIG_FILE" <- Remediation
View remediation
Security audit
Obsidian Official CLI Headless
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned but needs review because its root-run setup scripts can make broad system changes, create an unsafe wrapper, and modify vault notes during verification.
Review this skill before installing on any important host. Use only a carefully chosen vault path, clear privileged environment variables such as WRAPPER_PATH and OBSIDIAN_USER, avoid running verification unless you accept a write to the daily note, and prefer a version that validates paths, safely creates the wrapper, and verifies the downloaded package.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/configure_official_cli.sh:62- Finding
Unrestricted Privileged File Overwrite Through WRAPPER_PATH
- Content
View full analysis
"$WRAPPER_PATH" <- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/install_official_obsidian.sh:41- Finding
Downloaded Debian Package Is Installed as Root Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims to set up a safer headless model with a dedicated non-root user, ACL-restricted vault access, Xvfb adaptation, and a stable wrapper, but the analyzed behavior reportedly does not actually enforce those controls. This mismatch is dangerous because operators may trust the documented safety properties and run a workflow as root or in an incompletely configured state, exposing sensitive vault data or causing insecure system changes under false assumptions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs shell execution as root and references multiple installation/configuration scripts, but it declares no explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent may invoke shell commands without a formally constrained execution boundary, increasing the risk of unintended or over-privileged command execution in a high-impact system-modifying workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script, when run as root, recursively changes ACLs on a user-supplied vault path, modifies /root traversal permissions when the vault is under /root, writes a config file, and installs an executable wrapper under /usr/local/bin without any confirmation, scoping checks, or warning to the operator. In this headless Obsidian setup context these actions are expected, but they still create real risk because a mis-specified VAULT_PATH or wrapper path can silently broaden access to sensitive files or overwrite system binaries.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh set -euo pipefail if [[ ${EUID:-$(id -u)} -ne 0 ]]; then echo "Run as root." >&2 exit 1 fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh set -euo pipefail if [[ ${EUID:-$(id -u)} -ne 0 ]]; then echo "Run as root." >&2 exit 1 fi
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This shell script runs as root and makes system-level changes by updating packages, installing dependencies, and creating a new local user account. Although it prints status messages after some actions, there is no prior disclosure or confirmation warning that these privileged changes will be made to the host system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The verification script performs a real write to the user's vault by appending a marker to the daily note, which modifies user data during what appears to be a validation step. In this skill context, the behavior is likely intended as an end-to-end test, but it is still unsafe because it changes persistent note content without explicit consent, dry-run support, or cleanup.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The verification sequence includes a write operation,
obs daily:append content="skill verification", but the skill does not warn that verification will modify user vault contents. In a notes or knowledge-management context, silent data mutation can damage trust, pollute records, or alter sensitive files unexpectedly, even if the change seems minor.- Content